Getting Data In
Highlighted

index future date events as today's date in _time

Path Finder

I am getting a future timestamped event, but I want to index it as default time of index. i.e. at the time when it got indexed.

Presently I have changed

MAXDAYSHENCE = 0

in my props.conf. But I found out that the event having tomorrow's date are getting index with tomorrow's date instead of today's date.

alt text

Like today its 23 July, I am looking for any events after today to be indexed for time 23 July. But in my case 24 July is taken as a valid date which should not be the case.

Any other workaround would be appreciated.

The source data is JSON response of API which I am indexing via python script and taking PED field as _time

0 Karma
Highlighted

Re: index future date events as today's date in _time

SplunkTrust
SplunkTrust
0 Karma